Using FindHit
4 messages in this thread
[Favourite salutation here],
I've been programming in C for quite a while now and have always managed
to find a way to fix enforcer hits by a brute force apporoach. (If I got
a hit I would comment out any code that might be causing it and narrow
down the amount of code I had to search through until the hit was gone.)
Quite some time ago I got FindHit which seemed like a great way to speed
up the process. I guess I never got it to work because I eventually
forgot all about it. Now I have a CIS account and a greater need than
ever to program on my own, I figured I might give FindHit another if
someone could simply explain what I am doing wrong.
I compile my program by setting scoptions via SCOPTS (I do everything from
the WB). I set DEBUG = LINE, and turn on MAP with all mapping options and
<filename>.map in the string gadget. Program compiles beautifully.
When I run FindHit with the arguements mentioned in docs :
FindHit <filename>.map offset ### hunk ###
I get the message "file is not executable". And this is correct. The
*.map file is ascii. If I remove the .map extension in the above command
line it gives me back "cback Line 2" or some such useless information.
Can someone give me a clue or is it back to brute force coding?
Thanks in advance,
Carl
"All these memories will be lost, | Carl Leduc
in time…like tears in rain." |
Carl,
Hmmm, I've never used FindHit until just now. I typed in:
9.HEARTOFGOLD.ARTHUR:StarTrek/RELEASE1> findhit st $2568a
main.c : Line 1737
and my debugger shows that offset 2568a IS at line 1737 of main.c
my copy of the docs says you don't put in keywords like 'offset' and
'hunk'
I use it as follows:
Compile 'prog.exe' with appropriate debugging on.
'run segtracker' right after setpatch in my startup-sequence
(this patches loadseg to give better info from enforcer stack traces)
run enforcer with stackcheck and stacklines=11
When I get an enforcer hit, the return addresses on the stack are checked
against segtracker's list, and the hunk and offset are printed out. These
numbers are used in the find hit command line along with prog.exe the name
of the actual executable program.
The "brute force" technique that you describe is unnecessarily brutish, even
if you can't get findhit to work. Here's the cookbook approach to finding
enforcer hits by hand:
1. Compile with DEBUG=LINE, NOOPT (default) and create a map file
with MAP, MAPHUNK, MAPXREF.
2. Obtain the segment number and offset of the hit.
3. Read the HUNK section of the map to determine which module the
offset is in. The HUNK section is the first one in the map, and it
lists the beginning offset for each module. The highest beginning
offset that is lower than your offset is the winner.
4. Subtract the beginning offset of the hunk from the offset of the hit.
Remember, the offsets are in hexadecimal.
5. Use OMD to get a disassembly of the object module. Specify the C
source file as well so you get interleaved C and assembly language.
6. Bring up the disassembly in an editor. Scroll down to the offset you
calculated in step 4. Walla, you have found the mentioned offset.
The instruction that caused the hit is usually one or two instructions
BEFORE the reported offset.
7. Go get a backrub, you'll need it by this time.
Actually, although it sounds complicated, I did this so many times that it
became second nature to me. It's not bad once you get used to navigating in
the map files.
–Doug